Environment
Novell Audit 1.0.3 File Channel
Novell Audit 2.0.0 File Channel
Novell Audit 2.0.1 File Channel
Situation
Events are being recorded to the file channel.
The events can take five (5) or more minutes before they show
up in the file channel log file.
Is there any way to reduce the amount of time for events to
show up in the file channel log file?
Resolution
Events are stored in memory for an amount of
time specified in the file channel. By default, the file
channel is configured to flush the log files after 300 seconds,
which happens to be five (5) minutes. You can go in and
change the parameter from 300 to a smaller number, such as 15 or 30
seconds. Here are the steps used to change the flush log
files after xxx seconds:
1.) Open a web browser and start iManager (http:///nps/iManager.html
2.) Click on "Auditing and Logging" task. Select"Logging Server Options". Select your logging server
object. This is typically named " Logging
Server" and it is usually found in the Logging Services container
found just off of [Root]. Then click on the OK button.
3.) You should be on the "General" tab with the"Summary" being displayed. Click on the link for your file
channel.
4.) A new window should popup. Look for the "Flush
log file after:" parameter. The default setting here is
300. Make a change to something smaller, such as 15 or 30
seconds. Click on the "OK" or "Apply" button to save your
changes.
5.) The Secure Logging Server (SLS) will not read this
configuration change. You will need to shutdown and restart
your SLS.